Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-482 |
Comparing instead of Assigning
The code uses an operator for comparison when the intention was to perform an assignment. |
|
| CWE-553 |
Command Shell in Externally Accessible Directory
A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server. |
|
| CWE-182 |
Collapse of Data into Unsafe Value
The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property. |
|
| CWE-498 |
Cloneable Class Containing Sensitive Information
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class. |
|
| CWE-602 |
Client-Side Enforcement of Server-Side Security
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
|
| CWE-319 |
Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
|
| CWE-526 |
Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information. |
|
| CWE-315 |
Cleartext Storage of Sensitive Information in a Cookie
The product stores sensitive information in cleartext in a cookie. |
|
| CWE-316 |
Cleartext Storage of Sensitive Information in Memory
The product stores sensitive information in cleartext in memory. |
|
| CWE-317 |
Cleartext Storage of Sensitive Information in GUI
The product stores sensitive information in cleartext within the GUI. |
|
| CWE-318 |
Cleartext Storage of Sensitive Information in Executable
The product stores sensitive information in cleartext in an executable. |
|
| CWE-312 |
Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
|
| CWE-314 |
Cleartext Storage in the Registry
The product stores sensitive information in cleartext in the registry. |
|
| CWE-313 |
Cleartext Storage in a File or on Disk
The product stores sensitive information in cleartext in a file, or on disk. |
|
| CWE-1087 |
Class with Virtual Method without a Virtual Destructor
A class contains a virtual method, but the method does not have an associated virtual destructor. |
|
| CWE-1074 |
Class with Excessively Deep Inheritance
A class has an inheritance level that is too high, i.e., it has a large number of parent classes. |
|
| CWE-1086 |
Class with Excessive Number of Child Classes
A class contains an unnecessarily large number of children. |
|
| CWE-1082 |
Class Instance Self Destruction Control Element
The code contains a class instance that calls the method or function to delete or destroy itself. |
|
| CWE-300 |
Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. |
|
| CWE-1117 |
Callable with Insufficient Behavioral Summary
The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes. |